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PURPOSE- To monitor the existence of unauthorized address managing device and terminal equipment 
by storing a pair of regular network layer address(NAD) and data link layer address(DAD) and collating 
whether or not the NAD and DAD described on a packet being transmitted on a network are stored ones. 



CONSTITUTION- A network monitoring part 14 fetches the packet running on the network, and judges 
whether or not the packet is that of DHCoffer message by observing the OP field of a DHCP message in 
which a VDP data field is housed. When it is a DHCPoffer, an address managing network layer address 
from which the message is sent out is read out from the giaddr field or giaddr field of a DHC message, 
and it is checked whether or not the address is already registered on an address list 131, and when it is 
not registered, it is assumed that the unauthorized address managing device exists in the network, then, 
the effect is reported to a network manager, and a countermeasure is taken. 
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